We've been discussing tagging strategies for our docker ECR repos and what we've landed on doesn't involve use of the latest
tag at all.
I know latest
isn't anything automatic. It's just a regular tag. But it's also a convention. Is it expected that latest
exists? Are there tooling problems or things that may break if our repos don't have it at all?
You should be fine without the latest
tag - there should be no tooling problems as long as you are using other tags and / or sha256 digests explicitly for pulling images.
That said, usually there is no good reason to avoid latest
tag completely. Conventional approach is to push your latest acceptable build to its own tag AND the latest
tag. It is hard to find an argument against this approach, since using latest
is convenient in many non-scripted cases (i.e., a developer pulling the image locally and just using latest
) - and at the same time you get this image with its proper tag.
Final thing I want to mention - since tags may be mutable, scripted pipelines and especially production instances should use explicit sha256 digests when pulling images.